There is no absolute security. When we are talking about security, it is important to understand what are the threats, what are the risks and what security is enough to mitigate these risks.
User permissions are bound to the user name (login name, account name). So user name is not a secret within a web site. Where as user password remains unknown even for the web site itself (assuming web site is keeping password hash only). That's why the strength of the resistance of the web site to brute-forcing depends not on the fact if user name is known to the attacker, but on the strength of the password only.
What is bad in displaying too many details in case login failed? If you display message "incorrect password", you implicitly confirm that the user name is valid. In case the web site provides online banking, the information that particular user name is registered at this web site can be used by attacker for frauds and attacks. In case the web site represents some political organization, disclosing that particular user name is registered at this web site can lead to reputational problems for particular person.
So should you always provide a very generic message? No. It depends on the context. For instance, if the web site provides some services to the members of the local bowling club and all members are known to everyone in the town, then disclosing that some user name is known (or is unknown) to the web site would not give any new information and thus will not cause any harm to the users. In this case it can make sense to display more detailed message thus providing better user experience.
In you particular case only you (or your users, your customers) can decide what is more important - security or user experience.